Posted
by
samzenpuson Thursday October 03, 2013 @08:07AM
from the lock-it-down dept.

An anonymous reader writes "Simon St. Laurent reviews the options in the wake of recent NSA revelations. 'Security has to reboot. What has passed for strong security until now is going to be considered only casual security going forward. As I put it last week, the damage that has become visible over the past few months means that we need to start planning for a computing world with minimal trust.'"

It has been available for a kind of long time. RFC 2440 for encrypted email was written in the 1990s, but people are really resistant to anything that might help their own privacy. I can't even get my friends to use "Off The Record" for secure IMing. They don't care that their IM is going unencrypted over the network, or at least not enough to spend 2 minutes to install it.

Yes nothing is perfect including this but encryption is a lot better than not. Endpoints (who you talk to) is still exposed but having your message contents hidden still seems like an improvement, but people won't do it even when it's easy and you prompt them to.

I don't see the point in encrypting all my IM either. If the government wants to watch me joke around with my friends, let them. I encrypt passwords and banking info, but who cares about the rest?

If your friends felt they really had something they needed to tell you about in private, then they could talk to you via an encrypted connection from a Live CD, or tell you in person. For the rest, nobody cares.

A similar thing happened to a friend in Germany. And not, the German police didn't feel like idiots, and quite happily wrecked the guys life. If you have a gun, you never feel like an idiot. Instead you just pull the trigger on anybody who dares to snicker...

A similar thing happened to a friend in Germany. And not, the German police didn't feel like idiots, and quite happily wrecked the guys life. If you have a gun, you never feel like an idiot. Instead you just pull the trigger on anybody who dares to snicker...

Yeah, they stop laughing quick. Then they call in the SWAT team that's more heavily armed than you are.

Um, I think ArsenneLupin was referring to the police as the one's with the guns, who wouldn't feel like idiots, and who would kill anyone who pokes fun at authority. As an attempt at pointing out how out-of-control people can be when armed and in a position of authority or power.

But then, your comment about SWAT teams actually just reinforces that point, so hey.

I'm aware of that, but generally the worst that happens if they don't like you is that they'll stop you from legally entering the US. You have to be being a douchebag on a pretty epic scale before they start being able to justify rendition.

I'm aware of that, but generally the worst that happens if they don't like you is that they'll stop you from legally entering the US. You have to be being a douchebag on a pretty epic scale before they start being able to justify rendition.

ORLY?

Do you think Khalid El-Masri [wikipedia.org] and Maher Arar [wikipedia.org] would agree? Or do you not have a Muslim sounding name, so you figure you'll be fine? First they came for the Muslims, something something...

Is not just monitoring [schneier.com]. Your lack of security will be used against you. If you have something critical enough in another country, you probably have a logical bomb running on your infrastructure. Stuxnet [wikipedia.org] is an obsolete example by now.

But even without logical bombs, information means control, if they have all your information they could control you, or your population. If your cou

Yes, I could get hassled if I try to fly into America. But I already knew that before the NSA shitstorm. Everyone knows that. This new wiretapping bullshit doesn't really change anything for me. In fact, considering this was made "legal" with the PATRIOT act, it isn't even a surprise. I'm not sure why anyone is surprised. I thought the whole point in the PATRIOT act was so that the government could abuse their power needlessly.

Yeah? What exactly do I need to be kept "safe" from? Are they going to send thugs round to interrogate me for flirting on Facebook?

"If you give me six lines written by the hand of the most honest of men, I will find something in them which will hang him." -Cardinal Richelieu

No I would imagine not. Any given person likely has little to fear from increased surveillance; most people's lives are uninteresting. But if someone is looking at you with the intent of finding wrongdoing, they will find it. Especially if they have a history to look back on.

The other issue is that these surveillance powers are being used against anyone the US government doesn't like, for whatever reason. Do you agree with everything the US government does and says? I'd guess not. Do you support the actions of people who are organizing to push back against those policies you disagree with? I'd imagine so. Well these surveillance (and detention) powers are being used against those groups who are fighting for what you believe in, whether you participate or not. So your interests are being indirectly harmed by these powers.

You don't even need to be actually flirting. Just keeping pictures of nice ladies on your computer can be enough. Or just helpfully repairing the computer of a friend who happens to keep such pictures is enough.

I do. I fucking care that I can't communicate without big brother leaning over my shoulder to make sure I'm a good citizen. It's fucked up. Even if they never used a single byte of the data, the act itself is fucked up. Besides that, laws change. Much more of your day to day life than you imagine is already illegal to some extent or another. With pervasive eavesdropping you're just one ticked off bureaucrat away from a prison sentence. And even if you yourself by some miracle live (an almost impossible) squeaky clean lifestyle, it's even less likely that your family and friends to as well.

I don't see the point in encrypting all my IM either. If the government wants to watch me joke around with my friends, let them.

Then you're part of the problem. You should never let the government conduct such surveillance, and by doing so, you make it more difficult for intelligent people who do care about their privacy to protect said privacy.

Oh, and just because you think what you're saying is harmless, that doesn't mean the government thinks so. There are numerous cases of the government misinterpreting jokes and statements and then proceeding to try to ruin people's lives. Surely you don't want to suffer the same fate? Or do you believe that people who work for the government are perfect angels? From your comment, I would think not, but it's truly baffling that you would suggest that it doesn't matter if the government conducts such surveilla

So you do not really care about privacy, wether it be government (yours or others) or organised crime.

Privacy is a requirement for personal safety. Wether it is financial, physical or psychological safety. You give up your safety too easily and think it does not matter. I am fine with the first (for now) but not the second.

This is because most people don't care, most of the time.For the same reason they use credit cards instead of cash. Now go stand around your local headshop and see how many people suddenly switch to cash.

It has been available for a kind of long time. RFC 2440 for encrypted email was written in the 1990s, but people are really resistant to anything that might help their own privacy.

The problem is getting a critical mass of users to adopt encryption. And although it's largerly a matter of people either not caring, or not knowing enough to care, it's also a problem of not wanting to stand out in the crowd and risk getting singled out. My friends and I don't use e-mail encryption because, with so few other regular users of it, we would simply be marking ourselves for special attention from TLA's.

It's the kind of thing where a significant portion of the population - say 10% - needs to start using e-mail encryption simultaneously. And unfortunately, that's not likely to happen any time soon. I've said it before and I'll say it again: like sleight-of-hand in a magician's act, bread and circuses really do work to keep people distracted from what their leaders and masters are doing. Until enough of us pull our heads out of our popcorn bags, organize, and start engaging in the Internet's equivalent of 'passive resistance', the 1% and their minions are going to keep screwing us over.

Yes globally many smart people will question their professors, tutors and wonder what they where educated on.
They will start to write their own code out of pride or nationalism and be able to offer it to their govs at a fair market rate.
No more trade deals to select from a few 'big' UK/UK brands at a low price and with long term support totally locking out skilled locals.
The only way into air gapped systems will be via special forces teams breaking in or bribed local staff.
Both options are very expensiv

Another issue is state and national databases. If they all connect with junk encryption, junk servers, junk OS they are open.
Millions of people can be sorted per country thanks to poor software and hardware import deals.

RFC 2440 [describing OpenPGP] for encrypted email was written in the 1990s, but people are really resistant to anything that might help their own privacy.

You talk about OpenPGP. How much does it cost to travel to get your key signed by people who are well connected in the web of trust? And how can you trust that the people who signed the key of the person with whom you want to communicate are reliable at signing keys?

I can't even get my friends to use "Off The Record" for secure IMing.

That depends on whether a client supporting Off The Record is available for a particular operating system (such as Windows Phone) and how easy it is to start using. Mobile operating systems prefer monolithic apps over protocol plug-ins that can

Anyone remember when the NSA threw a fit regarding 128bit SSL becoming the next standard?

Then suddenly there was silence, and technology moved forward to 256bit and then 1024 etc... never to hear another whisper from the NSA.

This should have been the beginning of all the questions

For most of us in the field, we rely on solutions doing what they say they will; in order to meet the requirements we set. So we have to maintain some level of trust somewhere, but at the same time, trust wasn't a part of the risk

This is the thing. Even if you trust an organization to try and do the right thing, do you trust their IT staff to be competent? Do you trust their provider? Unfortunately most people by nature are far too trusting with all this stuff.

That is the real problem. If all I do is work from my desktop then I can just use kmail and its fairly strong gpg support and I'm done. The problem is that I use many operating systems, including ChromeOS, so I need Android clients, web-based clients, etc. I've yet to see anybody write a really good web-based email client, and even the IMAP options are very limited if you want to use tag-based email management (as in Gmail).

I really don't want to use Gmail. Its identity management is broken on Android, it isn't good at threading, there is no way to use it with encryption, and it gives Google access to all my mail. The problem is that nobody has come up with an equivalent FOSS option. The best I can do is cobble together a bunch of stuff and still get an inferior product. I've yet to find a web-based MUA that handles keyboard shortcuts nearly as well as Gmail...

I try to get my family to stop using gmail, and instead use a local mail program which they can then use for end to end encryption, private non-cloud storage of their old emails, etc, but they don't want to bother. They'd rather have google storing all their emails and are fine with the advertising they get shown as a result of the data-mining of the email contents. They don't care about the NSA because they "aren't doing anything wrong".

That's what security is up against: people who want to put all their information in "the cloud" and don't really care what that means for privacy and security or even services that can disappear at any time or change their terms of service at any moment. It's all about the simplicity, and nothing else matters except allowing it to be a brainless usage model.

There are PGP plug-ins for Chrome and Mail in Mac, at least. Why not exchange PGP keys with the family? I have used the gpgtools in the past in my Mac, and it is much pretty easy to install and use then.

I ain't got no time for dat! Seriously.. it's about the backbone technology. Your average person isn't gong to be a subject matter expert on computer security. It has to be embedded in a transparent fashion to make it work and it has to be a transparent technology (as in open source) so the government doesn't use it for their own ends.

PGP by definition has to have an element of trust unknown for 3rd players, i.e. the private keys. If gmail implemented it, it was almost the same as not having it. and I certainly wouldn't see the point of using it. The point of using it on your side, in a TRANSPARENT method, is for google not be able to access your private messages too. Note, you don't have to be an expert, the installation of the tools have just to be simple enough. After exchange keys, the software is smart enough to know when you are se

The screwy thing about that, is that it needs a plugin at all. This is ancient shit. For the last 15-20 years, most email clients have come ready to use pgp out of the box, but then you get to the high-profile (i.e. popular, because it comes with pre-installed consumer OSes) email clients, and they require people to search for plugins, in order to get basic 1990s-level tech. The problem used to mainly just be Apple Mail and MS Outlook (and then, sadly, Thunderbird, WTF) but then smartphones got popular,

You always trade some privacy and security in exchange for being social and active. The terms of the compromise are up to the individual. If you're insisting your family should get end to end encryption and they don't want it, YOU'RE the brainless one for not realizing your preferences are not their preferences.

I understand how to do exactly everything you're asking your family to do, and yet I still trust all my email to Gmail.

The reason is that it makes the data readily accessible. I'd like to read my email from arbitrary computers using only a web browser, and routinely read my email in this way so the client needs keyboard shortcuts/etc.

Sure, I could set up squirrelmail or roundcube and use IMAP with some client on Android (and have done so in the past), but the software is very clunky. With gmail I can proc

True. Privacy is not a technological issue but a political one.I could barricade my windows, put steel fence around my house, install EM shielding etc. Would not be a nice life, through. The same is for Internet privacy: I could install packet filter, firewalls, encrypt everything, but it's not a nice experience of the Internet then.

That is why we need strong privacy laws. We have privacy laws of mail and phone calls, why we don't have privacy laws for e-Mail and Web sites, Skype, etc.? Privacy laws are ess

They don't care about the NSA because they "aren't doing anything wrong".

They are missing the experience of living in a police state, bless them. One of the reasons Germany is a little (not enough, but a little) less ignorant of this is that many of its citizens still remember the GDR and the Stasi.

Even risking to Gowdin this, but maybe it gets them thinking to tell them that the Jews in Germany also thought they didn't do anything wrong. The Nazis, on the other hand, were very happy that religious affiliation was on government record and were extremely efficient in rounding up all the Jews who, remember, didn't do anything wrong.

People have always been like this as long as civilization has been around. Some people fully understand a technology and take the details of it into their own hands, while others are more comfortable with someone else providing the expertise.

This. Those individuals don't understand the problem, don't want to understand the problem, and frankly don't care about the problem. To them it isn't a problem, or at least not their problem. Now, you harping on about it and making it their problem on the other hand...different story...

Take the view of the Pentagon and assume that you are at all times compromised. You probably are. Any given entity can be broken into by a determined hacker. Talk to a pen tester sometime and ask them how many places they have failed to break into. The entire concept of trust is that you can send data privately over the Internet, you can't unless you encrypt your data offline ahead of time.

On the Internet trust is all about identity and encryption. For most people that translates into a certificate that is used to supply SSL. People then assume that because they are using SSL that they can now trust a given connection. There is no justification for trust and there never has been, the entire concept of trust is a misunderstanding of the concept of how a Certificate Authority works.

All a Certificate Authority does is say that their is an unbroken chain of identity from a given point to a given point. Even then a Certificate can be forged or stolen or issued improperly, and even if controls detect a bad certificate in use most people will click the button to use the bad certificate anyways.

All of this assumes that a given government entity hasn't used a court order to force a Certificate Authority to replicate a Certificate so that your data can be seized. Certificate Authorities cooperate with things like court orders, they don't self destruct like Lavabit. That whole backstory with Lavabit self destructing - it was a fight over getting the key that was used because he wouldn't hand over his private key.

People also forget that SSL is wholly dependent on Certificate Authorities. SSL is used to encrypt data with a key when data is in transit. The problem is that data anyone that owns the network can conduct [sourcefire.com] an MITM [bluecoat.com] attack against your key. SSL is fundamentally broken because it presents a perception of trust when it is incapable of providing that level of trust.

The CA never has a copy of the SSL certificate necessary for doing key exchange.

The public certificate is what is signed by the CA. It's also handed out to anyone that asks for an SSL connection, so it's hardly secret. The private key is only ever held by the certificate owner, not by the CA.

If a CA is complicit (or gives you a copy of their key), you can create a pretty good MITM by generating a new keypair with the target's information (obtained from the public cert) and signing that. However, you cannot

Not when you hold the same keys the real CA does. The NSA may well have their own copies of these keys.

The CA doesn't hold any private keys, at least not usually. Even the Mossad allows you to skip giving away your private key.

So, all a malicious CA can do is issue a second certificate with the same info, but for a different private/public key pair. But that means that the fingerprint will be different (this is a hash over the entire certificate, including the public key, which won't match the public key of the original).

And how many users do you think bother to regularly check every SSL cert is indeed legit?

It is irrelevant. As soon as ONE user spots it-- and SOMEONE will-- the jig is up: everyone will know surveillance is happening, theyll know which CA issued the phony cert, and theyll un-trust that CA.

It is however fairly easy to see if someone has created a forged cert with an alternate CA, as the cert thumbprint and CA chain would be different.

It in indeed easy to see when a cert has changed.

The difficult bit is deciding whether that cert change is legitimate or not. Sites do change their certs for a wide variety of reasons (upcoming expiry, dumb admin loses the keys, need a different selection of domains on the cert) and larger sites often end up with different load balanced/geolocated instances using different certs. So seeing a different cert from other people isn't nessacerally an indication of foul play.

Even worse, you can't trust just _a_ CA. You need to trust every single of them. Including CNNIC, Etisalat who conduct massive MITM attacks themselves, Turktrust and co who are merely criminally sloppy, and the whole rest, 95% of whom I suspect to not even wince when a three letter agency requests a fake cert pair.

I trust some people's knowledge and expertise in one domain, but not in another. Likewise, if I were a US citizen running an entirely legal US company I'd have not the slightest problem with trusting the NSA cloud with all my company data (if they had such a service). I trust AES with keeping my personal data unencryptable by crooks and criminals, but I probably wouldn't use AES to encrypt all my data if I were a member of the Chinese military. It really depends in the threat scenario and your goals. An unconditional discussion of trust is fruitless.

"the damage that has become visible over the past few months means that we need to start planning for a computing world with minimal trust"

Oh, come on. I mean I don't know about most people, but there has been no day during my life around computers during which I would've ever thought that computers, the networks, the internet, and/or services were more secure or more trustworthy than that 'minimal' the poster talks about. And I'd expect everyone with enough experince and insight to feel the same. So this

I mean that. Nothing has changed. The issue is still the same: At some point you have to trust someone. Not everyone can write their own software. Even fewer can write their own operating system. Only very few can write their own compiler. Almost nobody can build their own hardware. Unless you are a government agency with almost unlimited budget, you have to trust someone at some point.

It may not be the provider of your technology - it can be someone checking it. The way we don't bring every piece of food w

98% of the ones that actually voted (in countries where the vote is obligatory the government is choosen by everyone, not the specially motivated, paid to go to vote or partial by definition). And the electoral process have some flaws, only Lesters can say for who you can vote [ted.com], in (most?) places you can't vote for no candidate, and of course, the opponent did a bad enough campaign to make sure that the people voted for Obama if were for make sure that he wasnt elected, and as the only way to get even notice

Why would a government not take the effort to look into what people do on a daily basis when they have the technology.

To me it was also predictable, because I've read history books and noticed again and again that the most ruthless, sociopathic, often bloodthirsty control freaks are the ones who want power so badly that they'll do anything to achieve it. That's the nature of government. Public awareness and understanding is the only real thing holding it back. We have public apathy and ignorance because most people have been softened and made complacent by convenience and pointless indulgences (hundreds of channels of brain-dead horse-shit, news media controlled by 5 corporations all of which are cozy with government, public education for obedient workers and not for self-directed thinkers).

But that the government would want to spy on its people and would use technology in that manner, no that's not remotely surprising to anyone who understands the nature of governments and the people who most want to run them. What we need is a majority of people who comprehend this basic fact that has been repeatedly observed throughout history. The stakes are higher now, and become higher the more our tech advances. Our leaders have noted that bread and circuses works, that's because they actually do learn from history.

because I've read history books and noticed again and again that the most ruthless, sociopathic, often bloodthirsty control freaks are the ones who want power so badly that they'll do anything to achieve it. That's the nature of government.

Give that man a cookie.

I had a few years in an elected position. In the end, I gave it up because I couldn't take standing up against the egomaniac psychopaths anymore whose only concern was themselves and their position. These people will win out because people like you or me will reach a point where we just can't take it any longer, but for them it's the meaning of life.

For most people it is really not an issue, you only have to worry when you have something to hide. It's funny how people whine and freak out about privacy but they don't really have a point, only the assumed guilty act like they must hid what they do. People who know they aren't breaking the law and don't intend to aren't afraid of just letting people see what they do on a daily basis.

I thought this board had moved past this argument. How do you know you're not doing something illegal? Do you have a working knowledge of every law on the books for your state or local municipality, let alone the federal government? Are you under the impression that all laws are reasonable and adhere to your common sense? Is your idea of "wrong" the same as everyone employed at the NSA? Are you aware that these surveillance powers are being used against people who have not broken a law but are critical

I like how all the "conspiracy theory" people are generally considered wacko, yet more of their predictions or "conspiracies" come to be yet they are never given validity.

The people who want modern-day prophets to be wrong so they can ridicule them, call them names, and feel better for a moment about their pitifully desperate and meaningless lives, well, these are not the kind of people who like to admit when they are wrong and try to avoid repeating the same mistake.

Validity was never to be expected from the likes of them. Such people aren't interested in truth. They're interested in feeling superior to someone else. This is fundamentally incompatible with a search fo

No. It's a noise level problem. MOST conspiracy theories are wrong. There are thousands of conspiracies happening at all times, and still most conspiracy theories are wrong. And it's not because the existing conspiracies are successfully remaining unpostulated.

So. MOST conspiracy theories are wrong. Possibly as many as 95% of them. But many of them are correct. How can you identify the correct ones? Did Castro arrange to have Kennedy shot? How do you know? Was 9/11 and inside job? How do you kno

Do what you have at your hands, you can improve a lot your security in the points where you control. And let the rest of the world figure the missing pieces, with open source software you also have portability, when an alternative comes in that area (i.e. moving to ARM) you will be able to take a step forward. Just don't get too tied to a solution that you can't control.